{
    "version": "3.0",
    "name": "Detection Priority by Threat Actors",
    "description": "security-content detection priorty by common techniques used from threat actors",
    "domain": "mitre-enterprise",
    "techniques": [
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1027",
            "score": 52,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1193",
            "score": 51,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1204.002",
            "score": 49,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml"
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.001",
            "score": 36,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1086",
            "score": 44,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1059.003",
            "score": 34,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml"
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1105",
            "score": 40,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1060",
            "score": 38,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "score": 35,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1071.001",
            "score": 32,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml"
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.004",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1107",
            "score": 30,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1078",
            "score": 27,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml"
        },
        {
            "techniqueID": "T1053.005",
            "score": 24,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1003.001",
            "score": 20,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml"
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.005",
            "score": 26,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1082",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1192",
            "score": 24,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.002",
            "score": 23,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1083",
            "score": 23,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1203",
            "score": 21,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml"
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1005",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1057",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1016",
            "score": 22,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055",
            "score": 21,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1076",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.001",
            "score": 16,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml"
        },
        {
            "techniqueID": "T1056.001",
            "score": 20,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1140",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1018",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.001",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "score": 19,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1033",
            "score": 18,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1189",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1047",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
        },
        {
            "techniqueID": "T1003",
            "score": 17,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.001",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "score": 15,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml"
        },
        {
            "techniqueID": "T1043",
            "score": 16,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1112",
            "score": 13,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml"
        },
        {
            "techniqueID": "T1555.003",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1503",
            "score": 15,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1049",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.001",
            "score": 11,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml"
        },
        {
            "techniqueID": "T1087.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1116",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "score": 14,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1046",
            "score": 13,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.002",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1113",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1041",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1045",
            "score": 12,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1021.002",
            "score": 9,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml"
        },
        {
            "techniqueID": "T1574.002",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1085",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1073",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "score": 10,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml"
        },
        {
            "techniqueID": "T1133",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1518.001",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1063",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1571",
            "score": 11,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml"
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1100",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1505.003",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1136.002",
            "score": 10,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1119",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1068",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml"
        },
        {
            "techniqueID": "T1562.001",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml"
        },
        {
            "techniqueID": "T1090",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1173",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.003",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.002",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1143",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110",
            "score": 9,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.010",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1548.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1065",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1219",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1190",
            "score": 6,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml"
        },
        {
            "techniqueID": "T1071.004",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml"
        },
        {
            "techniqueID": "T1035",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1569.002",
            "score": 7,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml"
        },
        {
            "techniqueID": "T1137",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1135",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1117",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.004",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.002",
            "score": 8,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.009",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1023",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1221",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.001",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml"
        },
        {
            "techniqueID": "T1098",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.005",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1106",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1012",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1066",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.002",
            "score": 7,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml"
        },
        {
            "techniqueID": "T1048.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml"
        },
        {
            "techniqueID": "T1134",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1009",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.004",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.002",
            "score": 5,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml"
        },
        {
            "techniqueID": "T1027.001",
            "score": 6,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1158",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1120",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1223",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1015",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.004",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml"
        },
        {
            "techniqueID": "T1099",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.005",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1170",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1040",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.008",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml"
        },
        {
            "techniqueID": "T1075",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.002",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.003",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
        },
        {
            "techniqueID": "T1070.006",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.003",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.001",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1194",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1084",
            "score": 5,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.002",
            "score": 4,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml"
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.003",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml"
        },
        {
            "techniqueID": "T1518",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1094",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1025",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1038",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1496",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1124",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1093",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.005",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.002",
            "score": 3,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml"
        },
        {
            "techniqueID": "T1574.001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1014",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1487",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.012",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1570",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.003",
            "score": 4,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1020",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1572",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1104",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1072",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml"
        },
        {
            "techniqueID": "T1542.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1069.001",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1486",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1500",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1095",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml"
        },
        {
            "techniqueID": "T1090.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.002",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml"
        },
        {
            "techniqueID": "T1091",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1550.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1097",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1071.003",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1485",
            "score": 2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml"
        },
        {
            "techniqueID": "T1027.004",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1008",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1067",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1039",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1197",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1110.002",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1529",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1188",
            "score": 3,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1003.003",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml"
        },
        {
            "techniqueID": "T1201",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.005",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1199",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1559.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1567.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1125",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1004",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1115",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1080",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.007",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1213.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1195.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1210",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1087.003",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1222.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1492",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1032",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1176",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1187",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1109",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1480.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1037.001",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1191",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.002",
            "score": 2,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1114.001",
            "score": 1,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        },
        {
            "techniqueID": "T1568.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1146",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1504",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.011",
            "score": -2,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml"
        },
        {
            "techniqueID": "T1036.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.009",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1501",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1183",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1200",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1211",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1052.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1001.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1552.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.008",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1042",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1216.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1126",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1098.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1172",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1182",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1527",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1220",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1092",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1562.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1489",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1558.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1214",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1556.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1186",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1028",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1010",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1565.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1090.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1482",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1123",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.005",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1534",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1494",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1491.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.003",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1528",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1145",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1493",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.001",
            "score": 0,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml"
        },
        {
            "techniqueID": "T1550.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1568.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1070.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1564.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1055.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.012",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1127.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1122",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1488",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1096",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.015",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1174",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1134.001",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1030",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1137.004",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1483",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1497.002",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1138",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1546.013",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1026",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.006",
            "score": 1,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1078.004",
            "score": -12,
            "showSubtechniques": true,
            "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml"
        }
    ],
    "gradient": {
        "colors": [
            "#66b1ff",
            "#ff66f4",
            "#ff6666"
        ],
        "minValue": 0,
        "maxValue": 51
    },
    "filters": {
        "platforms": [
            "Windows",
            "Linux",
            "macOS",
            "AWS",
            "GCP",
            "Azure",
            "Office 365",
            "SaaS"
        ]
    },
    "legendItems": [
        {
            "label": "Low Priority",
            "color": "#66b1ff"
        },
        {
            "label": "Medium Priority",
            "color": "#ff66f4"
        },
        {
            "label": "High Priority",
            "color": "#ff6666"
        }
    ],
    "showTacticRowBackground": true,
    "tacticRowBackground": "#dddddd"
}